NFI North Data Breach: 49,540 Individuals Impacted

NFI North, a nonprofit organization that provides mental health and behavioral health services in Maine and New Hampshire, disclosed a data breach that affected approximately 49,540 individuals in the United States.

The breach was first disclosed to the attorneys general of Maine, Massachusetts and Vermont in November 2025. A supplemental notification was filed with the New Hampshire Attorney General on Aug. 5, 2026, identifying 2,813 New Hampshire residents as affected.

On or about Sept. 6, 2025, NFI North detected a network security incident in which an unauthorized third party gained access to the organization's network environment. The company engaged third-party forensic specialists to help secure the network and investigate the scope of unauthorized activity.

The forensic investigation determined that certain files may have been accessed without authorization and that data had been exfiltrated from the network. A preliminary review completed on Nov. 5, 2025, found that personal information may have been impacted by the incident.

NFI North then began what it described as a comprehensive and time-intensive review of the systems subject to unauthorized access in order to identify potentially impacted individuals, the types of data involved and contact information for those affected.

That review concluded on July 6, 2026. It confirmed that the unauthorized third party may have acquired personal information and protected health information during the incident.

The types of information exposed included names, Social Security numbers, other personally identifiable information and protected health information.

NFI North's response to the breach

NFI North is offering affected individuals free credit monitoring, credit report and credit score services through Cyberscout, a TransUnion company.

To enroll in credit monitoring, affected individuals can visit Cyberscout's enrollment page and enter the unique code included in their notification letter. Enrollment must be completed within 90 days of the date of the letter.

NFI North has set up dedicated help lines for affected individuals. Individuals who received initial notification letters can call 1-800-405-6108, while those who received supplemental notifications can call 833-851-8878. Representatives are available Monday through Friday from 8 a.m. to 8 p.m. Eastern time, excluding holidays, for 90 days from the date of the notification letter.